antigravity: forward GOOGLE_CLOUD_{PROJECT,LOCATION} env to AGY config

[joycel-github]

Summary

The README documents GOOGLE_CLOUD_PROJECT / GOOGLE_CLOUD_LOCATION / GOOGLE_GENAI_USE_VERTEXAI=True as the way to run the antigravity sidecar against Vertex AI, but the AGY SDK does not read these env vars — it requires vertex/project/location explicitly on LocalAgentConfig. After #177 bumped to google-antigravity==0.1.5 (which restructured the config API), this surfaces as: user sets all 3 documented env vars → ax exec fails per-request with A Gemini API key is required.

This PR makes the sidecar read those env vars at startup and pass them to LocalAgentConfig.__init__ so AGY's @model_validator picks them up. Also moves credential validation from per-request to startup with a single exit point in main() for symmetry with the vertex env validation.

Why pass to __init__ rather than mutate

AGY's _apply_shorthand_configs runs once at construction (as a @pydantic.model_validator(mode="after")). Post-init mutation of config.{vertex,project,location} does NOT regenerate config.models, so AGY's per-endpoint validate_endpoint() still sees the default GeminiAPIEndpoint(api_key=None) and rejects the request. Passing via __init__(**_vertex_kwargs_from_env()) lets the validator generate the correct VertexEndpoint(project=..., location=...).

Changes

• python/antigravity/harness_server.py:
  • New _env_use_vertex() helper (env flag check).
  • New _vertex_kwargs_from_env() — returns dict of {vertex, project, location} from env, or {} if env doesn't request Vertex. Raises ValueError if Vertex requested but project/location missing.
  • _build_default_config() calls LocalAgentConfig(..., **_vertex_kwargs_from_env()) so env values flow through AGY's __init__ validators.
  • _has_credentials rewritten to mirror AGY's per-endpoint validation: only GEMINI_API_KEY env, config.api_key, or config.vertex=True + config.{project,location} (dropped GOOGLE_API_KEY and per-model api_keys; AGY doesn't accept them).
  • Credential check moved from per-request (_run_turn) to startup (main); single try/except in main() is the only exit point — helpers raise ValueError, main prints ERROR: ... to stderr and exits 1.
  • Replaced loaded_config module global with _build_default_config() factory injected into the servicer constructor. TODOs mark where Antigravity harness read and apply configs from rpc requests #194's per-request harness_config layering will plug in.
  • Renamed module-private helpers to _-prefix (_serve, _enhance_config_from_env, _resolve_localhost).
• python/antigravity/harness_server_test.py:
  • 6 vertex env tests + 1 end-to-end _build_default_config_picks_up_vertex_env test + 2 credential tests (vertex requires project+location; Express Mode) + 2 servicer DI tests.
  • Existing tests updated to inject config via constructor (no module-global mutation).

Verification

Unit tests: 17/17 pass against google-antigravity==0.1.5 (current PyPI wheel, uploaded 2026-06-25). go build + go test: clean.

End-to-end via ax exec → ax serve → sidecar → AGY → Vertex AI:

Scenario	Env	Result
Vertex happy path	GOOGLE_GENAI_USE_VERTEXAI=True + GOOGLE_CLOUD_PROJECT=cloud-ai-agentic-coding + GOOGLE_CLOUD_LOCATION=global	Sidecar boots: Vertex AI backend configured: project=... location=.... ax exec "capital of France?" → real Vertex/Gemini response: Paris is the capital of France.
Vertex + missing PROJECT	GOOGLE_GENAI_USE_VERTEXAI=True + GOOGLE_CLOUD_LOCATION=us-east1	Exits 1 at startup: ERROR: Vertex AI backend requested but missing required config: project (set GOOGLE_CLOUD_PROJECT)
No credentials	(none)	Exits 1 at startup: ERROR: No Gemini credentials configured. Set GEMINI_API_KEY (AI Studio) or GOOGLE_GENAI_USE_VERTEXAI=True + GOOGLE_CLOUD_{PROJECT,LOCATION} (Vertex AI).

Sidecar log: [gRPC] Running chat query → [gRPC] Turn completed successfully. No mocked-tool involvement — response is real model output from Vertex AI.

Out of scope

• Per-request harness_config layering (Antigravity harness read and apply configs from rpc requests #194) — TODO markers placed.
• Substrate path: deployed via baked image / actor template, no env forwarding needed.

Closes #225.